First Flight #17: Dussehra

Summary

The foundry tool has ffi cheat code which as per foundry docs "is generally advised to be used as a last resort, and to no enable it by default, as anyone who can change the tests of a project will be able to execute arbitrary commands on devices that run the tests".

Vulnerability Details

The project has ffi enabled by default and also runs some tests which remove the lib folder from the TLD(Top-level Directory), create new folders etc.

This can be dangerous if tests were introduced by a malicious tester to leak the Private Keys, GitHub tokens or any other sensitive information from the project

1. Tester can create ffi commands to copy the .env folder with a different name

2. The Protocol is pushed to GitHub

3. Now the sensitive Information has been leaked

Impact

This can easily escalate from almost no impact to a Critical Issue (If Private Keys were Leaked)

Tools Used

1. Manual Review

2. Foundry

Recommendations

It is advised to add ffi = false to the foundry.toml to set ffi to true only when absolutely necessary to test some functionality